[PATCH mptcp-next v2 1/2] selftests: mptcp: convert iptables to nftables for mptcp_sockopt.sh
From: Hangbin Liu <hidden>
Date: 2026-09-03 01:12:59
Also in:
bpf, linux-kselftest, lkml, mptcp
Subsystem:
kernel selftest framework, networking [general], networking [mptcp], the rest · Maintainers:
Shuah Khan, Shuah Khan, "David S. Miller", Eric Dumazet, Jakub Kicinski, Paolo Abeni, Matthieu Baerts, Mat Martineau, Linus Torvalds
From: Hangbin Liu <redacted> During the conversion, we retain the same filter and chain names previously used by iptables/ip6tables. Counters are not added to accept rules because the test does not inspect them. After conversion, the generated output matches the original iptables/ip6tables behavior. Signed-off-by: Hangbin Liu <redacted> --- tools/testing/selftests/net/mptcp/mptcp_lib.sh | 2 +- tools/testing/selftests/net/mptcp/mptcp_sockopt.sh | 51 ++++++++++++---------- 2 files changed, 29 insertions(+), 24 deletions(-)
diff --git a/tools/testing/selftests/net/mptcp/mptcp_lib.sh b/tools/testing/selftests/net/mptcp/mptcp_lib.sh
index b9d14647f401..41febb1bbbc7 100644
--- a/tools/testing/selftests/net/mptcp/mptcp_lib.sh
+++ b/tools/testing/selftests/net/mptcp/mptcp_lib.sh@@ -528,7 +528,7 @@ mptcp_lib_check_tools() { exit ${KSFT_SKIP} fi ;; - "iptables"* | "ip6tables"*) + "iptables"* | "ip6tables"* | "nft"*) if ! "${tool}" -V &> /dev/null; then mptcp_lib_pr_skip "Could not run all tests without ${tool}" exit ${KSFT_SKIP}
diff --git a/tools/testing/selftests/net/mptcp/mptcp_sockopt.sh b/tools/testing/selftests/net/mptcp/mptcp_sockopt.sh
index e850a87429b6..a2c20483986d 100755
--- a/tools/testing/selftests/net/mptcp/mptcp_sockopt.sh
+++ b/tools/testing/selftests/net/mptcp/mptcp_sockopt.sh@@ -15,8 +15,6 @@ cin="" cout="" timeout_poll=30 timeout_test=$((timeout_poll * 2 + 1)) -iptables="iptables" -ip6tables="ip6tables" ns1="" ns2=""
@@ -50,15 +48,25 @@ add_mark_rules() local m=$2 local t - for t in ${iptables} ${ip6tables}; do + for t in ip ip6; do + ip netns exec "$ns" nft add table "$t" filter + ip netns exec "$ns" nft add chain "$t" filter OUTPUT \ + '{ type filter hook output priority 0; policy accept; }' + # just to debug: check we have multiple subflows connection requests - ip netns exec $ns $t -A OUTPUT -p tcp --syn -m mark --mark $m -j ACCEPT + ip netns exec "$ns" nft add rule "$t" filter OUTPUT \ + tcp flags \& \(fin \| syn \| rst \| ack\) == syn \ + meta mark "$m" accept # RST packets might be handled by a internal dummy socket - ip netns exec $ns $t -A OUTPUT -p tcp --tcp-flags RST RST -m mark --mark 0 -j ACCEPT + ip netns exec "$ns" nft add rule "$t" filter OUTPUT \ + tcp flags \& rst == rst meta mark 0x0 accept + + ip netns exec "$ns" nft add rule "$t" filter OUTPUT \ + meta l4proto tcp meta mark "$m" accept + ip netns exec "$ns" nft add rule "$t" filter OUTPUT \ + meta l4proto tcp meta mark 0 counter drop - ip netns exec $ns $t -A OUTPUT -p tcp -m mark --mark $m -j ACCEPT - ip netns exec $ns $t -A OUTPUT -p tcp -m mark --mark 0 -j DROP done }
@@ -105,32 +113,29 @@ cleanup() mptcp_lib_check_mptcp mptcp_lib_check_kallsyms -mptcp_lib_check_tools ip "${iptables}" "${ip6tables}" +mptcp_lib_check_tools ip nft check_mark() { local ns=$1 local af=$2 - local tables=${iptables} + local tables="ip" if [ $af -eq 6 ];then - tables=${ip6tables} + tables="ip6" fi - local counters values - counters=$(ip netns exec $ns $tables -v -L OUTPUT | grep DROP) - values=${counters%DROP*} - - local v - for v in $values; do - if [ $v -ne 0 ]; then - mptcp_lib_pr_fail "got $tables $values in ns $ns," \ - "not 0 - not all expected packets marked" - ret=${KSFT_FAIL} - return 1 - fi - done + local values + values=$(ip netns exec "$ns" nft list table "$tables" filter | \ + grep -o "packets.*drop" | awk '{print $2}') + + if [[ ! "$values" =~ ^[0-9]+$ ]] || [ "$values" -ne 0 ]; then + mptcp_lib_pr_fail "got $tables $values in ns $ns," \ + "not 0 - not all expected packets marked" + ret=${KSFT_FAIL} + return 1 + fi return 0 }
--
2.55.0